CVE-2025-11573 Denial of Service issue in Amazon.IonDotnet
An attacker can cause a denial of service via infinite loop using crafted text input in the deprecated Amazon.IonDotnet library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-11573?
CVE-2025-11573 is a high-severity denial of service vulnerability in Amazon.IonDotnet, published on 9 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial of service through a specially crafted text input.
To mitigate this issue, users should upgrade to version v1.3.2. As of August 20, 2025, this library has been deprecated and will not receive further updates.
Weakness: CWE-1286
Which versions are affected by CVE-2025-11573?
2 open source packages ship an affected version, including Amazon.IonDotnet.
| Package | Affected | Fixed in |
|---|---|---|
Amazon.IonDotnet NuGet | All versions | 1.3.2 |
Amazon.IonDotnet NuGet | All versions | 1.3.2 |
How do I fix CVE-2025-11573?
Upgrade Amazon.IonDotnet to 1.3.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-11573 being exploited?
There is no known exploitation of CVE-2025-11573 in the wild and no public exploit code.
Sources
Also known as GHSA-q5r6-9qwq-g2wj.